Medical device regulation: landscape and trends

MDR throughout the product lifecycle

Medical device regulation (MDR) spans the product life cycle of a medical device from discovery to distribution. Medical device companies must create and submit reports to both regulatory and notified bodies to comply with MDR. Regulatory bodies set the rules in each jurisdiction, while notified bodies evaluate and certify compliance with those rules.

Literature review – systematically searching, reviewing, and summarizing published studies, articles, reports and other data sources – is required to support MDR at each stage of a product’s existence. This includes pre-market research, development and clinical evidence, and collating and evaluating scientific and clinical data related to the post-market safety, efficacy and performance of medical devices.

Trends and challenges in medical device regulation

In one study opens in new tab/window¹ of medical device leaders, gaining market approval for new products (40%) and ensuring compliance with a regulatory body (47%) were identified as top priorities. These tasks are becoming more difficult as legislation gets tougher and the volume of literature to review increases.

The global nature of the medical device industry presents several challenges to medical device and biotechnology companies. Key challenges include:

New legislation in EU for medical devices

The EU adopted new legislation for medical devices and in vitro diagnostic medical devices (IVD) in May 2017:

• Regulation (EU) 2017/745 opens in new tab/window² (EU MDR)

• Regulation (EU) 2017/746 opens in new tab/window³ (EU IVDR)

Recognizing the significant task of recertifying all devices under these rules, the EU introduced Regulation (EU) 2023/607 opens in new tab/window to further extend the transition deadline for legacy medical device recertification. Device companies must now recertify:

• Higher risk devices (Class III and IIB implantable devices) by December 31, 2027

• Lower risk devices (Class IIB non-implantable devices, and Class IIA and Class I devices) by December 31, 2028

• Custom-made implantable devices by May 2026

Device companies should be applying for recertification now to mitigate potential losses or delays due to:

• Quantity of devices needing to be recertified: estimates suggest opens in new tab/window⁵ approximately 500,000 medical devices still to be recertified

• Length of certification process: Recertification previously took a minimum of six months. This will likely increase as the new legislation introduces more stringent safety and performance requirements, and notification bodies capable of recertification are limited.

Increasing volume and cost of regulation

Research opens in new tab/window⁶ shows a 64% increase in regulations for device manufacturers since 2015, with 13,485 individual regulations in place by 2022. In the US the average total cost opens in new tab/window⁷ for participants to bring a premarket 510(k) opens in new tab/window⁸ product from concept to clearance is estimated at $31 million, with $24 million of that spent on FDA-related activities. That figure rises to $75 million for a high-risk Class III device. Some reports opens in new tab/window⁹ suggest that in the EU, the more stringent MDR regulations have increased certification costs for manufacturers tenfold.

Length of time for approval

Depending on the region, complexity of the device, regulatory path, availability of clinical data and completeness of submission, the time it takes to gain approval can range from several weeks to many months. For example:

• FDA (USA) — Between one week and eight months opens in new tab/window¹⁰, depending on whether a company self-registers, submits a 510(k) application, or submits a Premarket Approval (PMA) application

• EMA (Europe) — 13 to 18 months opens in new tab/window¹¹ to obtain a CE marking for a medical device in the EU where this process requires the involvement of a notified body

• PMDA (Japan) — 1-3 years opens in new tab/window¹² depending on classification of device; this makes Japan one of the longest approval times in major markets

• CDSCO (India) — 6-9 months opens in new tab/window¹³, unlike other regions this is regardless of risk classification

• TGA (Australia) — Between 3 and 174 days opens in new tab/window¹⁴. The process is split into two steps: Stage 1 is the conformity assessment, taking an average of 137 days, and Part 2 depends on the risk classification of the device

Limited number of skilled personnel and process automation

Medical device companies struggle to find enough knowledge management and regulatory affairs professionals who can:

• Understand new regulation and reporting requirements

• Create automated processes for analyzing literature

• Disseminate that knowledge to the company

Teams that rely on manual processes may be slower to respond and have an increased risk of error.

Sustainability in design and manufacturing

With government and corporate commitments to climate action, medical device companies must address sustainability in the design and manufacturing of their products, including:

• Materials: Many countries are considering or introducing legislation around areas like single-use plastics that will impact medical devices.

• Manufacturing processes: The FDA is conducting opens in new tab/window¹⁵ a number of pilot programs around sustainability in medical device manufacturing and is expected to introduce future legislation to this area.

• Supply chain and packaging: The EU has introduced a series of directives opens in new tab/window¹⁶ around supply chain sustainability and reusable packaging.

• Sustainability appraisal: In the UK, the MHRA is considering several amendments opens in new tab/window¹⁷ to current regulations to improve sustainability, including the need for a sustainability appraisal in device conformity assessments.

Growth in digital and internet connected medical devices

The increase in digitally enabled and internet connected medical devices results in several new challenges that will require future legislation concerning:

• 3D printed devices: Research opens in new tab/window¹⁸ suggests new legal and regulatory frameworks will be needed to deal with the “ambiguities” over how pre-3D printing regulation is applied.

• Smart devices: Regulation will need to evolve to answer questions around wearable, implantable, injectable, ingestible and nanodevices, such as “Are smartwatches and health trackers medical devices?”

• AI and machine learning: Devices that incorporate AI and machine learning will need to address AI bias, ethical dilemmas, transparency and AI explainability.

• Connected devices: Devices connected via 5G, Bluetooth and IoT networks raise issues, such as who is responsible for a device malfunction or failure – the device manufacturer or the carrier network?

• Cybersecurity: From March 2023, the FDA expanded opens in new tab/window¹⁹ the scope of reviews beyond safety and performance to include the cybersecurity of medical devices.

MDR webinars

Interested in learning more about medical device regulation from industry and regulatory experts? Watch the following webinars:

Navigating the IVDR maze: From CE certification to IVD device registration opens in new tab/window

• Stefan Burde, PhD, Director, Global Focus Team IVD at TÜV SÜD

• Gary Saner, Sr. Manager, Information Solutions, Life Sciences, Reed Tech

• Dr. Bassil Akra, CEO and Owner of AKRA TEAM GmbH

How to pass your Clinical Evaluation Assessment Report (CEAR): Creating a pragmatic systematic literature review process to assure EU MDR approval opens in new tab/window

• Jacqueline van Druten, Clinical & Regulatory Affairs Director, CLIN-r+

• Danielle Thomas, Customer Consultant, Elsevier

• Maria Shkrob, Life Sciences Consultant, Elsevier

Demystifying EU MDR: Navigating compliance challenges and achieving CE certification opens in new tab/window

• Ben Bancroft, Medical Device Guru II, Guru Services

• Dr. Bassil Akra, CEO and Owner of AKRA TEAM GmbH

Key reports in medical device regulation

Reports required vary depending on the requirements of different regulatory and notifying bodies, and the risk classification of the device. Broadly, reports fall into pre-market assessments and post-market surveillance categories.

Pre-market – FDA

In the US, medical device companies submit pre-market approval applications to the FDA in one of three pathways depending on the device classification, which includes IVD products:

For the 510(k) and PMA pathways, manufacturers must supply extensive evidence from clinical investigations on the safety and efficacy of the device.

Pre-market – EU

Under the EU MDR, medical devices in certain risk classes must pass a pre-market authorization process known as Conformity Assessment. This determines whether all the requirements of the MDR for the device have been met to grant a CE marking that allows a device to be marketed in the EU. The Conformity Assessment covers:

• Technical documentation: Information about the device's design, performance, labeling, instructions for use, manufacturing processes and risk management

• General Safety and Performance Requirements (GSPRs): How the device meets GSPR requirements with appropriate evidence.

• Clinical Evaluation Report (CER): The CER is highly important, complex and requires input from knowledge management, regulatory and clinical professionals. It is considered a “living document” that must be periodically reviewed and updated with new evidence and clinical data opens in new tab/window²⁰ that becomes available. The CER contains the following elements:

  • Device description: materials used, design factors, intended purpose

  • Clinical evaluation plan: the methodology for conducting clinical evaluations and search strategy for identifying relevant data

  • Literature review: systematic and comprehensive review of published scientific literature relevant to the device, including a summary of the available evidence and any gaps or limitations

  • Clinical data: from studies conducted for the device being evaluated and from studies for a previously marketed equivalent device

  • State-of-the-art report: literature review of medical texts, clinical guidelines and peer-reviewed literature to demonstrate what is currently accepted as good practice, to prove a device is comparable to similar devices on the market and is minimal risk

  • Risk-benefit assessment: including adverse events, device failures and potential safety concerns from clinical evaluation

  • Summary of clinical evidence: meta-summary of overall clinical evidence supporting the safety and performance of the device and a conclusion on its ability to meet the intended clinical purpose

Once these reports are assembled, manufacturers must submit a Declaration of Conformity to state the device complies with the MDR stipulations. This declaration must be kept up to date and available upon request to any competent authority. For medium and high-risk devices, notified bodies — independent third-party bodies nominated by EU member states — assess submissions for conformity, review the documentation and conduct audits and on-site inspections before awarding the CE mark.

Reporting for In Vitro Diagnostic Regulation – EU

In the EU, IVD products are regulated separately under the EU IVDR. Companion diagnostics (CDx) are also covered under the IVDR legislation. IVDR submissions require manufacturers to submit extensive clinical evidence reports, including state-of-the-art analyses, under three headings (see fig).

Literature review is critical in two of the three. First, in establishing scientific validity, where manufacturers review academic research and scientific peer-reviewed literature from journals, conference posters, guidance or other official documents. And secondly for the clinical performance element, where peer-reviewed literature, clinical performance studies and published results of diagnostic testing must be included.

Post-market monitoring

Medical device manufacturers must conduct post-market monitoring for all their licensed medical devices. Manufacturers are required to put in place surveillance mechanisms for “reportable events” such as death, injury, other adverse effects, or a device malfunction that may pose a risk.

In recent years, regulators have taken steps to encourage active surveillance mechanisms to augment current passive surveillance methods. Passive surveillance is typically a combination of voluntary or mandatory activities, as is the case under the FDA’s post-market surveillance for medical devices; adverse events are reported to a central database or authority by device manufacturers, users or importers. Active surveillance is a proactive approach to gathering and analyzing data on potentially millions of patients in healthcare data systems; additional safety signals that may not have been identified as adverse events are detected and reported. Current passive surveillance systems employed by the FDA include:

• Manufacturer and User Facility Device Experience (MAUDE opens in new tab/window²¹): A database that “…houses medical device reports submitted to the FDA by mandatory reporters (manufacturers, importers, device user facilities) and voluntary reporters (health care professionals, patients and consumers).” MAUDE has known limitations because its web search is limited to the past 10 years of data. Manufacturers cannot therefore rely on the database as the sole source of surveillance, or to establish rates of events, or to compare devices.

• National Evaluation System for health Technology (NEST opens in new tab/window²²): A collaborative database intended to “…link and synthesize data from different sources across the medical device landscape, including clinical registries, electronic health records, and medical billing claims.”

• The Sentinel Initiative (Sentinel opens in new tab/window²³): Led by the FDA, Sentinel complements MAUDE and NEST, and was set up to “…develop new ways to assess the safety of approved medical products including drugs, vaccines, and medical devices.”

In the EU, manufacturers are obliged to plan for passive and active surveillance to gather, record and analyze data on each of their medical devices. Member states within the EU also have individual requirements for reporting adverse events that manufacturers must be aware of. Results of surveillance are used to update the Clinical Evaluation Report and must be submitted to a shared system employed by the EU:

• European Databank on Medical Devices (Eudamed opens in new tab/window²⁴): A collaborative system that “…integrate(s) different electronic systems to collate and process information about medical devices and related companies (e.g., manufacturers),” to which manufacturers submit a Summary of Safety and Clinical Performance (SSCP).

Mandatory post-market studies and reports – FDA

Post-market reports required by the FDA fill in knowledge gaps about a device, and enable manufacturers to address safety issues that have been raised through passive and active surveillance systems. They are:

• 522 Studies: evaluate specific aspects of, or overall device performance once a device is available on the market; often instigated when there are concerns or uncertainties about a device

• Post-Approval Studies (PAS): gather additional data on a device's long-term safety, performance and effectiveness, and submit interim results to the FDA as studies are carried out

• Recalls: report any action by manufacturers to recall, withdraw or correct a device

• Annual reports: cover areas like performance and changes to labelling or manufacturing of Class III or complex devices

• Periodic reports: address ad-hoc FDA requests for updated safety data, manufacturing changes, or results from ongoing clinical studies

In addition to the required reports from medical device companies, the FDA conducts its own reviews of the literature on medical device performance. Consequently, medical device companies will want to be proactive and perform their own reviews to mitigate the risk of recall, and identify and address any issues ahead of the FDA.

Why do regulatory submissions and applications get rejected?

Regulatory rejections or failures typically occur for two reasons:

1. Administrative review — the device manufacturer has errors in its submission

2. Substantive review — the weight of evidence is not deemed sufficient for approval

Substantive review might raise issues such as poor design, design faults and failure to use validated manufacturing practices. The materials used in a device’s manufacture may also be problematic. Other issues might be due to inaccurate or incomplete information. The following checklist can help you ensure a complete submission. Did you:

☑ Classify the device correctly ☑ Use up-to-date device classifications and definitions ☑ Fully assess safety performance ☑ Demonstrate no legal concerns or patent infringement ☑ Include clear labeling and instructions for use ☑ Submit all required documents, reports and evidence: - A thorough literature review - Clinical evidence on efficacy, performance and clinical benefits - State-of-the-Art requirements - Risk-benefit assessment, including a mitigation strategy

How to minimize rejections with the right literature tools and strategies

Medical device teams can significantly reduce the risk of regulatory rejection and the time associated with meeting requirements by conducting a thorough search for existing evidence in addition to having substantive product documentation. Thorough, accurate and timely use of literature reduces the burden on knowledge management, regulatory affairs and R&D professionals.

Checklist to evaluate a literature database for MDR compliance

☑ How far back does the information go? ☑ How comprehensive are the sources? ☑ Are there templates or guided search for greater efficiency, e.g., PICO search? ☑ Can you save search strings and deliver results at desired intervals? ☑ Does the database index specifically for medical devices, including: • Medical device adverse events • Medical device concepts • Global Medical Device Nomenclature (GDMN) names • Device tradenames

Medical device regulation by country

Most device manufacturers operate internationally and in multiple jurisdictions outside of the large markets in the US and the EU. They must therefore understand and comply with multiple sets of regulations simultaneously. In prioritizing markets to address, companies can acquire market sizing reports or rely on publicly available information.